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MULTISERVICE USE OF NETWORK CONNECTION CAPABILITY 
UNDER USER-TO-NETWORK INTERFACE SIGNALING 

BACKGROUND OF THE INVENTION 

1. Field Of The Invention 

The present invention is directed to a distributed switching system, such as, for example, 
a Multiservice Switching System based on, for example, firaine, cell or packet switching, that 
supports video, private line and data services. 

2. Discussion Of Background And Related Information 

A Multiservice Switching System (MSS) comprises a distributed switching device 
designed to support plural forms of data, such as, but not limited to, for example, voice, computer 
data and video signals. Switching can be based on, for example* but not limited to* frame, cell; 
or packet switching. Multiservice Switching Systems may use a broad range of access 
technologies, including, but not limited to, for example, time division multiplexing (TDM), digital 
subscriber lines (xDSL), wireless, and cable modems. 

In an ATM switched virtual circuit (SVC) sendee, a S VC customer can either initiate or 
tasninate a SVC service request via a user-to-network (UNI) interface. : The SVC customer may 
be, but is not limited to, for example, an individual subscriber, an enterprise network, an ISP, of 
a peer network. Service policies define the capabilities and resources available to the customer. 
The service policies also determine whether a service request succeeds or fails. 

The amount of data being transmitted between locations has rapidly escalated. Voice 
networks (e.g., traditional telephone networks) are becoming overwhelmed by the rapidly 
increasing traffic flow. Further, it is costly to coi^lract/expand such traditiorial telephbnie 
networks. As a result, companies are searching for ways to carry voice services over packet 
networks, and for removing data traffic from the voice networks. This has led to the development 
of media gateways and. media gateway controllers (referred to as distributed switches) that 
separate the service intelligence from the associated hardware, and allows voice and data to be 
carried over a packet network. 

Conventional architectures do not permit the separation of at setyice controller frOiri a 
transport controller. For example, in a conventional ATM switch, a cillihg party uses the UNI 
protocol to request an ATM SVC connection to another end system that is connected to the 
network. This request is carried by a signaling channel to an ATM edge switch, which terminates 
the UNI protocol and initiates a private network-network interface (PNNI) protocol to complete 
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a setup across the network to the edge switch that connects to the called party. The application 
of policy and decision to reject or accept a call is determined solely by an pn-board processor 
within the switch. That is, service control is packaged into the switch. No standardized ATM 
mechanism currently exists to utilize service control outside of the switch. 
5 BRIEF DESCRIPTION OF THE DRAWINGS 

The foregoing and other objects, features and advantages of the invention 
from the following more particular description of preferred embodiments, as illustrated in the 
accompanying drawings, which are presented as a nbrirlimtmg exam which reference 
characters refer to the same parts throughout the various ^ev^j md wherein: 
1 0 Fig. 1 illustrates an example ATM SVC service that utilizes intelligence separate from 

conventional ATM Switches that are useable with the present invention; 

Fig. 2 illustrates a conventional ATM Edge Switch and conventional SVC Service 
Controller useable with the example ATM SVC service of Fig. 1; 

Fig. 3 illustrates a next generation ATM Edge Switch and SVC Service and Switch 
15 Controller useable with the example ATM SVC service of Fig. 1; 

Fig. 4 illustrates an operation chart for a push method performed in accordance with the 
instant invention; 

Fig. 5 illustrates an operation chart for a pull method and a query method performed in 
accordance with the instant invention; and 
20 Fig. 6 illustrates ah operation chart for a method using certificates performed in accordance 

with the instant invention. 

DETAILED DESCRIPTION OF EMBODIMENTS 
Accordingly, an object of the current invention is to provide ,a mechanism whereby a 
switch, such as, for example, an ATM switch, can access an external semce cbntroL In particular, 
25 the present invention ailows multiple network services to' share a network connection capability 
in such a way that a predetermined signal, such as, for example, UNI signaling, is interpreted via 
service specific controls (such as, for example, data, policies and ti^fbrmations) contained 
within the netwoik. This is achieved in a uniform roaimer, Such that policies can be made globally 
available in the network. Further, user policy can be applied independent of the manner in which 
30 the user accesses the network. 

According to an object of the present invention, a multiservice switching system has a 
switching device having predetermined functions with respect to a request for a predetermined 
service, a switch controller that has a bearer function and a virtual switch function in order to 
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control the switching device, and a proxy device that contains service policies related to either 
enabling or denying the predetermined service, in which multiple service requests are correlated 
with respective services to enable at least one appropriate policy and logic. The switching device 
and the switch controller may comprise a conventional switch, such as, for example^ an ATM 

5 Switch, or a next generation switch. 

According to a feature of the invention, the mblti^iyice switching system further 
comprises a service controller. The service controller may. include, the switch controller. 
Alternatively, the switching device may include the switch controller. . 

According to another object of the invention, a method is disclosed for switching plural 

10 forms of data. A customer initiates a request for service. In response to the request, 
predetermined data related to the requested service is obtained. If the requested service, is 
permitted, the initiating customer is instructed to initiate a setup, such is, for example, a UNI 
setup, identifying the requested service. A PNNI protocol (setup) is completed across a network 
in response to the UNI setup, and a second UNI setup is initiated to accept or reject the service 

15 request, which is passed back to the initiating customer, wherein multiple service requests are 
correlated with respective services to enable at 
According to a fea^ 

obtained using at least one of a push procure that pushes the predetermined data, a pull 
procedure that pulls policy and/or logic (e.g.j a program) representing at least one of service 

20 capabilities and service permissions, a query (trigger) procedure that queries a service control 
module, or a certificate procedure that specifies permitted setup parameters, the push (download) . 
procedure and the pull procedure pushes and pulls" respectively, information into a Network 
Connection Capability, and then makes a decision regarding £L service.; The query procedure : 
provides facts (e.g., policy and/or logic), and then the service; makes a policy .and/or logic 

25 decision. 

According to an advantage of the invention, the certificate may be encrypted. In addition, 
a sequence number, that assists in preventing reuse of 4e certificate, may be assigned to the 
. : encrypted certificate. By examining the sequence nuinbef assigned to the certificate, it is possible 
to determine whether the sequence mimber (and thus, the cqtificate) was seen before. . In addition 
30 to the assigqment of the sequence number (or instead of using the sequence number), the 
certificate can be time-stamped and/or date-stamped. An examination of the time--stamp and/or 
date-stamp (with or without the sequence number) assists in detenniriing whether the certificate 
is valid. If the time^stamp and/or date-stamp exceeds a predetermined delta value, the certificate 
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is determined to be invalid, and thus, the service request is denied. 

A still further advantage of the inventibn resides in the encrypted certificate being able to 
identify which service allowed the setup. 

According to another object of the invention, a method for switching plural forms of data 
5 is disclosed. The method comprises initiating a service request by an imtiating customer, 
establishing the service request using a predetemiined setup, such as* for example, a ussr-to- 
network interface setup, and initiating a second predetermined setup, such as, for example, a user- 
to-ri^twdrk interface setup, to accept or reject the requested /service,' wherein multiple service 
requests are correlated with respective services to enable at least one appropriate policy and logic. 
10 According to a feature of the invention, a Service Control may request that initiating 

customer initiate the user-to-network interface setup. : 

According to another feature, if the service request is transfered over an ATM network, 
the user-tb-network interface setup is redirected from a switching device to a service controller. 
According to an advantage of the invention, the switching device is controlled by a switch 
1 5 controller. The switch controller may be integral with the switching device, or, alternatively, the 
switch controller may be integral with the service controller. 

Another advantage of the invention is that the service request may be established using at 
least one of a pushing procedure, a pulling procedure, a query procedure, and a certificate 
procedure. If the certificate procedure is employed, a certificate may establish what service 
20 requests uses the user-to-network interface setup. Further, the certificate may specify whiat setup 
parameters are permitted and/or which service allowed the setup; 

.. If desired, the certificate may be encrypted. In addition^ kt least one of a sequence number, 
a time-stamp, and a date-stamp may be used with the certificate to assist in verifying; that a 
certificate is valid. Thus, reuse of a certificate may be prevented. 
25 Fig. 1 discloses an example ATM SVC Service that can use the present invention, , 

comprising an initiating SVC service customer 10, a first ATM edge switch 12* an ATM core 
switch 14, a second ATM edge switch 16, a terminating SVC service customer 18, a first SVC 
service controller 20, a second SVC service controller 22j and a proxy device, such as, for 
example/a SVC service policy device 24. However, it is understood th^t modifications to this 
30 arrangement may be made without departing from the scope andAjr spirit of. the invention. \ 

Further, while the present invention is being described with reference to a UNI signal, it 
is understood that alternative signal protocols may be used without departing from the spirit arid/or 
scope of the invention. 
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The SVC customer 10 either initiates or terminates an SVC Service Request using UNI 
signaling. The SVC customer 10 may correspond to, for example, an individual subscriber, an 
enterprise network, an ISP or a peer network In addition, an ISPK to ATM gateway may also 
act on behalf of an SVC customer. Service policies define the capabilities and resources available 

5 to the customer, and also, determine whether a service request succeeds or fails. Example SVC . 
, service class capabilities include, but are not .limited to, constant bit rate (CBT), red time variable 
bit rate (rfcVBR), non-real time variable bit rke (ml-VBR), unspecified bit tate (UBR), available 
bit rate (ABR), calling line identification presentation and restriction (CLIP/CLIR). Example 
resources include* but are not limited to, for example, total bandwidth and total number of SVC's. 

10 Fig. 1 illustrates the ATM SVC being implemented with conventional ATM switches that 

contain both bearer control and virtual switch control in addition to the switching function, the 
structure of which is shown in greater detail in Fig. 2. According to the present invention, the 
ATM SVC Service Control (e.g., network service instance control fbiction NSICF) is removed .. 
from a switching device (e.g., ATM edge switch 12 or 16) and placed within a separate physical 

1 5 controller. In the first embodiment, bearer control and virtual switch control are bundled together 
(as a switch controller) with switching as part of a single physical unit, and the NSICF is bundled 
separately as the SVC Service Controller. UNI signaling is rediffekited ftom the edge switch to the 
SVC Service Controller via a permanent i virtual circuit (PVC). This allows the SVC Service 
Controller to apply policy and/or other transformations to UNI setup messages. If the SVC 

20 Service Controller permits a setup, the SVC Service Controller functions as a proxy agent for the 
SVC Service Customer, in accordance with, for exaiiiple, Annex 2 of ATM t[NI Si gn a lin g 
Specification Version 4,0, and issues a UNI setup command to the ATM Edge Switch. 

Fig. 2 illustrates a conventional switch, the conventional ATM Edge Switch 12 (or 16) 
comprises a first physical port 26, a virtual switch 28, a second physical port 30, a virtual switch 

25 controller 32, a bearer controller 34, and a third physical port 36. The first physical port 26 
includes a signaling gateway 3 8 and a logical port 40, while the second physical port 30 includes 
a logical port 42, 

The SVC Service Controller 20 (or 22) includes a first physical port 44, a Network Service 
Instance Control Function (NSICF) 46, and a second physical port 48. 
3 0 As shown in Fig. 2, an optional Service Gateway 50 is interfaced between the SVC Service 

Controller 20 (or 22) and the policy Server 24, 

It is noted that the construction and operation of the ATM Edge Switch, the SVC Service 
Controller and the Service Gateway is known to those skilled in the art Thus, a detailed described 
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of the structure and operation of these elements is omitted. It is further understood that variations 
in the construction of the Edge Switch, SVC Service Controller and Service Gateway may be 
made without departing from the scope and/or spirit of the iriv^tioiL 

While the invention is described with respect to an ATM SVC service, it is understood that 

5 the invention is not limited to ATM SVC service, but may be utilized with other network services. 
/ In order to implement the ATM SVC Service outside of the cohventibiiai 
signaling channel, produced by an SVC Service Customer, is redirected to an SVC Service 
Controller by a FVC or S-PVC. An SVC Service Customer may cbrirespond with an indiyidual 
subscriber (connected by, but not limited to, for example) an xDSL connection, an ISDN 

10 connection (using, for example, an ISDN to ATM Internetwork gateway), an enterprise network, 
an ISP or a peer network. In the disclosed embodiment, policies are stored in the database 24 
(e.g., policy server) that is physically separate from an individual Service Controller 20 (or 22). 
The database 24 is accessed by a service gateway 52 associated with the Service Gateway 50. The 
policy server 24 checks policies of both the calling party and the called party. 

1 5 While the policy server 24 is shown as being physically separate from the SVC Service 

Controllers, it is understood that variations in form, such as, btit not limited to, for example, 
incorporating the policies in one or more SVC Service Controllers 20 (or 22), may be made 
without departing from the spirit and/or scope of the invention 

The present invention discloses the use of a predetermined setup, such as, for example, 

20 UNI version 4.0 proxy, for the purpose of accessing bearer control As a result, the NSICF 46 
terminates the UNI stack However, it is understood that different protocols as, but not 
limited to, UNI version 3.1) may be used for accessing beara control ^ without departing from thei 
scope and/pr spirit of the invention. 

Fig. 3 illustrates ah example of an ATM Switch* m, which the ATM SVC Service is ; 

25 implemented using a next generation Multiservice Switching Function (MSF) ATM switch 54, 
In this regard, elements in this example that correspond to like elements in the first example are 
designated with the same element number. Further, a detailed discussed of such elements is not 
required. 

In the second example, the virtual switch controller 32 and -the bearer controller 34 are 
30 removed from the switch and are placed in a separate SVC Service Switph Controller 56, along 
with the NSICF 46. Further, UNI signaling passes 1^u|^ Wsw^ 54 and onto the NSICF 46 
within the Switch Controller 56. It is noted that for purposes of simplification* Fig. 3 omits 
physical paths sp and vsc. 
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The NSICF 46 applies policy and screening to a UNI setup message based oh a calling 
party and a called party, a requested service class, etc., via. the service feature gateway function. 
If the setup message is successful, the NSICF 46 invokes the bearer control function 34 that 
resides within the Switch Controller 56 that provides access to the networks SVG the 

5 Signaling Gateway function is placed within the physical. port to denote that the UNI signaling 

crosses the boundary 

NSICF. No policy is applied and the transport of the sigpalinjg does not change, the Bearer 
Control function 34 is implemented by initialing aFNtti protowl in the network direction in order 
to create a bearer connection across the network, Further, the Logical Port function is accessed 

10 via the virtual switch control function along sp to access this fimctibn. 

It is noted that in a multiservice environment, service control is not limited to AtM 
SVC's. Other transport devices, such as, but not limited to, for example, Frame relay and IP 
layered on top of AtM, may be used. 

The present invention solves the problem of multiple services sharing the same Network 

15 Connection Capability while utilizing a common UNI Signaling method. In the following 
discussion, it is assumed that a calling party needs to access different Network Connection 
Capabilities based upon the services the calling party participate? in. 

According to the instant invention, service customers access a service using either a 
dedicated signaling channel or a signaling network (which may optionally be IP based). During 

20 a service interaction, an ATM SVC Connection must l?e established between customers, thus, 
ohe of the end-systems initiates a UNI setup. Once the UNI initiates the SVC's between the ATM 
SVC Service and other Services, the Network Collection Capability cbrrelates the calling party 
setup request with the service it belorigs to, so that an appropriate policy is ajppliecL . 
The end-systems, the service, and the NetwoA Connection Capab 

25 their actions. Specifically, the Network Connection Capability must enable the enforcement of 
the service policy and/or logic (e.g., a program module) at least during the initial setup. Iel 
addition, the called party must be able to map an incoming UNI to the appropriate 
service/application. 

Four procedures are discussed below for enabling ^orcement of the service policy and/or 
30 logic, in accordance with the present invention. However, it is understood that the invention is 
not limited to the four procedures discussed below, and thus, should not be interpreted as limiting 
the scope of the invention; alternative procedures may be employed without departing fiom the 
scope and/or spirit of the invention. 
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In the first procedure, to be discussed in detail below, the Service downloads (pushes) . 
policy and/or logic into the NetWork Connection Capability before it requests the end-user to do 
a UNI setup; In the second procedure, to be discussed in detail below, the Netwoik Connection 
Capability pulls in pdlicy and/or logic from the Service, when it receives a setup or other signaling 

5 message. In the third procedure, to be discussed in detail below, the Network Connection 
Capability queries the Service when it receives a setup or other signaling inesSage. In the fourth 
procedure, to be discussed below in detail, the Service sends the service customer an encrypted 
certificate that allows a setup phase to go through without r^uinng interaction between the 
Service and the Network Connection Capability. 

10 It is noted that the Network Connection Capability must be able to map the incoming setup 

to the corresponding service in the first through third procedures. In the fourth procedure, the 
service provides the end-system with a (preferably non-reusable) certificate that allows it to do 
the permitted setup. The end-system of the fourth procedure includes the certificate in its setup 
message, so that the controller does not have to consult with the service in order to determine 

15 whether to allow the setup, It is noted that while the certificate is preferably encrypted with the 
permissions as well as a sequence number, tins is not a requirement of the instant invention. 

TTie first procedure will now be described with reference to Fig. 4. In the first procedure, 
policy and/pr logic is pushed (downloaded) into the Network Connection Capability before it 
requests the end-system to do a UNI setup: In accordance with this procedure, the Netwoik 

20 Connection Capability maps the incoming setup to a corresponding service. This requires 
encoding a service instance unique ED (s_id), using known techniques, in the setup frbin the 
calling party. 

At step 1 (see Fig. 4), a service request is made to a Service Controller 58. The Service . 

Controller 58 then pushes (step 2) policy and/or logic to control the Network Connection 
25 Capability. Hien, in step 3, the Service Control 58 requests that the service customer 10 initiate 

a UNI setup containing the sjd. The UNI setup is directed (step 4) from the customer 10 to the 

SVC Controller 20 (located within the Network Connection Capability), and contains the s _id. 

Since multiple customers may initiate multiple SVCs corresponding to a single service, the sjd 
. functions to identify the service and the i^C.insto^ 
30 In step 5, a proxy UNI is sent to the edge switch 12. As a result, FNNt is transmitted 

across the network (step 6), which results in the forwarding of a proxy UNI to the SVC Controller 

22 (located within the Network Connection Qyability) at step 1 Thereafter, step 8 is performed 

to "initiate UNI to the service customer 18. 
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In order for the customer to map the hKXMnmgUM setups 
contains an application identifier or one of the SVC Controller 22 or the Service Control 58 must 
alert the service customer 1 8 of the incoming UNI and its Virtual Path Id^tifierA^irtual Channel 
Identifier (VPI/VCI), which is illustrated in Fig. 4 as Step 7.5, If the application identifier and 

5 service identifier are the same, the s_jd can be used. However, since this may not he the case, a 
different identifier is preferably used. 

The second procedure will now be described with reference, to Fig. 5. In the second 
procedure, the Network Connection Capability pulls in policy and/or logic in a manner similar to 
that described in the first procedure. 

10 At step 1 (see Fig. 5), a service request is made to the Sendee Control 58. In step 2, the 

Service Control 58 requests that the service customer 10 initiate aUNI setup containing s_id. The 
UNI setup is directed (step 3) from the customer 10 to the SVC Controller 20 (located within the 
Network Connection Capability), and contains the s_id. Since multiple customers may initiate 
multiple SVC's corresponding to a single service, the s_id functipns to identify the service and 

15 the SVC instance for the particular customer. Step 4 is then performed, in which the Network 
Connection Capability pulls policy and/or logic from the Service Control 58, which is completed 
by the reply provided in step 4.5. 

In step 5, a proxy UNI is sent to the edge switch 12. As a result, PNNI is used to do an 
SVC across the network (step 6), which results in a proxy UNI to the SVC Controller 22 (located 

20 within the Network Connection Capability) at step 7. Thereafter, step 8 is performed to initiate 
UNI to the service customer 18. As in the first procedure, the SVC Controller 22 or the Service 
Control 58 alerts (step 7.5) the service customer 18 of the incoming UNI and its VPI/VCI. 

The third procedure will now be described. As this procedure is similar to the pull 
procedure (e.g., second procedure) described aibove, the following discussipn will only be directed - 

25 to the differences. \ . 

In the third procedure, an incoming setup message results in a query to an appropriate 
service control module. Other queries, based, on, for example, mid-call signaling events, can also 
be defined. The query procedure includes a query and a response. In the case of a setup, the 
: response bqiitains information indicating whether the setujp should go through, iand under what 

30 conditions. 

It is noted that iii the second and third procedures, the interaction between the Network 
Connection Capability and the Service Control 58 must be timely, in order to avoid a time out 
condition. Further, the sjd is needed in the setup that uniquely identifies the service. 
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The third procedure differs from the first and second procedures in at least one important 
respect Specifically, in the query procedure, the service is not constrained by the capabilities of 
the: SVC Controller that interprets service policy and/or logic. 

V The fourth procedure will now be described with reference to Fig. 6. In the fourth 
5 procedure, multiple services use the same network connection capability under UNI Signaling 
without requiring an interaction between the sendees and the network connection capability . In 
accordance with this procedure, the Service Control 58 provides the service customer IQ with a : 
certificate allowing it to do a permitted setup. The certificate specifies permitted setup 
parameters. The service customer 10 includes the certificate in its setup message. In this regard, 
10 it is noted that the network connection capability does not need to consult with the Service Control 
58 in order to allow the setup. The certificate uniquely identifies which service allowed the setup, 
; . so that billing and accounting can be properly performed when this procedure is used with third 
parties. 

While the following discussion indicates that the certificate ate encrypt^ 
15 the encryption may be omitted without departing from the spirit and/or scope of the invention. 
It is also noted that the certificate may contain the permissions and/or a sequence number. 
According to the disclosed fourth procedure, certificates are non-reusable. Further, since events 
may happen asynchronously, the certificates niay not necessarily be used in the order that they are 
received* 

20 Each network service (s) bias a private key (E.s) that is used to encrypt certificates. For 

each encryption key, the network connection capability has a private decryption key (p.s). As a 
result, only the network connection capability can read a certificate, and only the network service 
can have originally generated the certificate, Further, according to the disclosed procedure, each 
certificate is preferably encrypted with a unique sequence number in order to ensure that a 

25 previous certificate is not used again. When. the Network Connection Capability decrypts a 
certificate, the Network Connection Capability examines the sequence number to determine 

.. whether the certificate has been seen. before. 

Keeping a record of each and every certificate (with thOT a^opiated sequence number) 
has been received: would require a Very large database. In order to minimize the size of this 

30 database, a preferred ; feature of the fourth procedure is to generate, certificates in which 
subsequently generated certificates have increasing sequence numbers. As a result, the network 
connection capability only needs to keep a limited size, history (which changes over time) of 
previously seen certificates for each service. In addition, the size of the database that must be 
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maintained can be further reduced by date-stamping (and/or time-stamping) the certificates in 
addition to assigning sequence numbers. If the date-stamped (and/or time-stamped) certificate : 
exceeds a predetermined delta value (such as, but not limited to, for example, 1 day and/or i 
minute), the certificate (and thus connection request) is rejected. 

5 Referring to Fig. 6, a service request is initially made to a Service Control 58 at step 1. 

In response, the Service Control 58 requests (steps 2) that tji§ service customer 10 initiate a 
certificate and a UNI setup containing s_id . The UNI setup (containing the s_id and certificate) 
is directed (step 3) from the customer 10 to the SVC Controller 20 that is located within the 
Network Connection Capability. 

10 In step 4, a proxy UNI is sent to the edge switch 12. As a result, PNNI is transmitted 

across the network (step 5), which results in a proxy UNI being sent to die SVC Controller 22 
(located within the Network Connection Capability) at step 6, As in the first method, the SVC 
Controller or the Service Control 58 alerts (step 6.5) the service customer of the incoming UNI 
and its VPI/VCI. Thereafter, step 7 is performed to initiate UNI to the service customer 1 8. 

1 5 The discussion above illustrates certain procedures for achieving the network corinectioa 

As previously noted, the instant invention is not dependent upon the specific implementation 
described above. Consequently, other implementations may be utilized without departing from ; 
the spirit and/or scope of the invention. 

It is noted that the push (download) procedure (e.g., the first procedure) allows third party 

20 service providers to be connected by thb Internet, ^ereasth^ 

It is further noted that once policy and/or logic is pushed (per the first procedure), it is locally 
available to a SVC Controller, where it can be applied in real-time to setup messages, as opposed 
to waiting to pull it in (per the second procedure) or querying to a service (per the third 
procedure). 

25 Further, the various procedures described above may be combined. For example, the push 

procedure may be combined with the query procedure. In such a combination, a setup can operate 
to query a service controller which then pushes policy and logic; alternatively (or in addition), 
queries can be placed on variables that represent tl^e state of a : call. 

The foregoing discussion has been provided inerely for the purpose of explanation and is 

30 in no way to be construed as 1iTT"ting of the present invention. While the present invention has 
been described with reference to exemplary embodiments, it is understood that the words which 
have been used herein are words of description and illustration, rather than words of limitation. 
Changes may be made, within the purview of the appended claims, as presently stated and as 
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amended, without departing from the scope and spirit of the present invention in its aspects. 
Although the present invention has been described herein with reference to particular means, 
materials aid embodiments, the present invention is not intended to be limited to me particulars 
disclosed herein; rather, the present invehtioh extends to all functionally equivalent structures, 
methods and uses, such as are within the scope of the appended claims. 

In accordance with .various embodiments of the present invention, the methods described 
herein are intended for operation as software programs running on a computer processor. 
Dedicated hardtware implementations including, but not limited to, application specific integrated 
circuits, programmable logic arrays and other hardware devices can likewise be constructed to 
implement the methods described herein. Furthermore, alternative software implementations 
including, but not limited to, distributed processing or component/object distributed processing, 
parallel processing, or virtual machine processing can also be constructed to implement the 
methods described herein. 

It is also noted thai the software implementations of the present invention as described 
herein are optionally stored on a tangible storage medium, such as: a magnetic medium such as 
a disk or tape; a magneto-optical or optical medium such as a disk; or a solid state medium such 
as a memory card or other package that houses one or more read-only (non-volatile) memories, 
random access memories, or other re-writeable (volatile) memories. A digital file attachment to 
e-mail or other self-contained information archive or set of archives is considered a distribution 
medium equivalent to a tangible storage medium. Accordingly, the invention is considered to. 
include a tangible storage medium or distribution medium, as listed herein and including art- 
recognized equivalents and successor media, in which the software implementations herein are 
stored. 

In addition, although the present specification describes components and functions 
implemented in the embodiments with reference to particular .standards and protocols, the 
invention is not limited to such standards and protocols. The standards for Internet and other 
packet-switched network transmission (eg., TCP/IP, UDP/IP, HTML, SHTML, DHTML, XML, 
PPP, FTP, SMTP, MIME); peripheral control (IrDA; RS232C; USB; ISA; ExCA; PCMCIA); and 
public telephone networks (ISDN, ATM, xDSL) represent examples of the state of the art Such 
standards are periodically superseded by faster or more efficient equivalents having essentially 
the same functions. Replacement standards and protocols having the similar functions are 
considered equivalents. 
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We claim: 

1. A multiservice switching system, comprising: 

a switching device having predetermined ftmctions with respect to a request for a : 
predetermined service; 

5 a switch controller having a bearer function and a virtual switch function for controlling : 

said switching device; and 

a proxy device containing at least one of service policies and logic related to one of. 

enabling and denying said predetermined service, in which multiple service requests are correlated 

with respective services to enable at least one appropriate policy and logic, 
10 2. The multisenice switching system of cldm 

switch controller comprise a conventional switch 

3. The multiservice switching system of claim 2, wherein said conventional switch 
comprises an ATM Switch. 

4. The multiservice switching system of claim 2, wherein said switching device md said 
i5 switch controller comprise a next generation switch. 

5. The multiservice Etching system of clam ; 
said service controller including said switch controller. 

6. The multiservice switching system of claim i, wherein said switching device includes 
said switch controller. 

20 7. A method for switching plural forms of data, comprising: 

having an initiating customer request a service; 
obtaining predetermined data related to the requested service; 

instructing the initiating customer to initiate a pretermitted setup identifying the 
requested service, when the requested service is permitted; 
25 passing a predetermined signal across a netWork in response to the predetermined setup; 

and 

initiating a second predetermined setup, in response to the passed predetermined signal, 
to one of accept and reject the requested service, the second predetermined signal being provided 
to the initiating customer, in which multiple service requests are correlated with respective 
30 services to enable at least one appropriate policy and logic. 

8. The method of claim 7, wherein obtaining comprises pushing the predetermined data. 

9. The method of claim 8, wherein the pushing predetermined data comprises pushing at 
least one of policy and logic representing at least one; of service capabilities and service 
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permissions, 

1 0. The method of claim 7, wherein obtaining comprises pidlirig the predetermined data, 

1 1. The method of claim 7, wherein obtaining comprises querying a service control 
module for the predetermined data. 

5 12. The method of claim 7, further comprising using a certificate to specify permitted 

setup parameters. 

1 3 . The method of claim 1 2, fi 

14. The method of claim 13. further comprising assigning a sequence number to the 
encrypted certificate. 

10 15. The method of claim 12, wherein die certificate further identifies which service 

allowed the setup. 

16, The method of claim 12, further comprising detOTnining whiter the certificate is 

valid. 

17. The method of claim 1 2, further comprising preventing reiise of the certificate. 

15 18. The method of claim 17, wherein preventing comprises examining a sequence number 

assigned to the certificate to determine whether the sequence number was seen before. 

19. The method of claim 17, wherein preventing; comprises examining at least one of a 
time-stamp and a date-stamp to determine wherein the at least one of the time-stamp arid the date- 
stamp exceeds a predetermined delta value. . : 
20 20. A method for switching plio^ fonns bf data, comprising: 

initiating a service request by an Mtiafog.cu&omer; 
establishing the service request using ^predetermined setup; arid 
initiating a second predetermined setup to one of accept and reject the requested service, 
in which multiple service requests are correlated with respective services to enable at least pne 
25 appropriate policy and logic. 

21. The method of claim 20, wherein establishing the service request comprises using a 
pushing procedure. 

22. The method of claim 20, wherein establishing the service request comprises using a 
pulling procedure. 

30 23 . The method of claim 20, wherein establishing the service request comprises using a 

query procedure. 

24. The method of claim 20, further comprising a Service Control that requests that the 
initiating customer initiate a user-to network interface setup. 
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25. The method of claim 20, wherein the service request is. transferred over an ATM 
network, the predetermined setup being redirected from a swtching device to a service controller. 

26. The method of claim 25 3 further comprising controlling the switching device with a 
switch controller, the switch controller being integral with the switching device. 

5 27. The method of claim 25, further comprising controlling the switching device with a 

switch controller, the switch controller being integral with tjie service controller. 

28. The method of claim 20, wherein establishing further comprises including a certificate 
for establishing the service request using the predetermined setup. . 

29. Hie method of claim 28, wherein the certificate specifies permitted setup parameters. 
10 30. The method of claim 28, further comprising encrypting the certificate. 

31. The method of claim 30, further comprising assigning a sequence number to the 
encrypted certificate. 

32. The method of claim 28, wherein the certificate further identifies which service 
allowed the setup. 

15 33. The method of claim 28, finther wmprising detenn^ 

valid. 

34. The method of claim 28, further comprising preventing reuse of the certificate. 

35 . The method of claim 34, wherein preventing comprises examining a sequence number 
assigned to the certificate to determine whether the sequence number was previously examined 
20 36. The method of claim 34, wherein preventing comprises e x a minin g at least one of a 

time-stamp and a date-stamp to determine whether the at least one of the time-stamp and the date- 
stamp exceeds a predetermined delta value. 

37. The method of claim 7, wherein the predetermined setup comprises a UNI setup, the 
predetermined signal comprises a PNNI protocol, and the second predetamined setup comprises 

25 a second UKfl setup. 

38. The method of claim 20, wherein the ^determined setup comprises a usa-to-network 

interface setup. 
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